registry / execbro / 1.10.18

execbro@1.10.18

ExecBro — MCP server giving AI agents eyes and hands into React Native apps. Logs, REPL, state inspection, tap, screenshot.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

At MCP runtime, failed tap actions can upload screenshots and UI/debug bundles automatically. OCR also uploads screenshots when cloud OCR is used; telemetry/licensing sends installation and device metadata.

Static reason

No blocking static signals were detected.

Trigger

Run the execbro MCP server and invoke relevant debugging tools.

Impact

Potential disclosure of React Native app screenshots, UI data, and device-identifying metadata to package-operated services.

Mechanism

Cloud telemetry, licensing, OCR, and failed-action artifact uploads.

Rationale

No malicious installation, persistence, remote-payload, or control-hijack behavior was found. Default cloud uploads of screenshots and continued metering after analytics opt-out warrant a warning for privacy-sensitive deployments.

Evidence

package.jsonbuild/index.jsbuild/core/failureArtifact.jsbuild/core/ocr.jsbuild/core/telemetry.jsbuild/core/license.jsbuild/core/fingerprint.js~/.execbro/telemetry.json~/.execbro/license.json/tmp/rn-devtools-telemetry.jsonl

Network endpoints4

rn-debugger-telemetry.500griven.workers.devrn-debugger-ocr.500griven.workers.dev

execbro@1.10.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code